Problems with missing properties accessExternalSchema accessExternalDTD in Xerces2
[email protected] Mon, 15 Jan 2024 12:47:32 +0100
| Newsgroups | gmane.text.xml.xerces-j.user |
|---|---|
| Message-ID | <[email protected]> |
--=_d5f61de0b2eed55bda4713863e081027 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; format=flowed Hello, First post here, since I am not able to comment in this project's Jira. I have run into an issue with Xerces2 during a Java 17 migration. JEP-403 mentions the following under "Risks and assumptions": "Code that uses the JDK's internal copy of the Xerces XML processor [might fail]. Such code should instead use a standalone copy of the Xerces library, available from Maven Central [1]." https://openjdk.org/jeps/403 The problem is that when including Xerces2 2.12.2 as a Maven dependency, two properties are not recognized, which are relevant for security (to prevent XXE attacks: http://javax.xml.XMLConstants/property/accessExternalSchema http://javax.xml.XMLConstants/property/accessExternalDTD There is an open Jira topic to support these properties: https://issues.apache.org/jira/browse/XERCESJ-1654 This was created in 2015 and I am wondering what the current status is and what a suitable workaround might be to fulfill that requirement of JEP-403. Thanks a lot! Cheers, Martin Links: ------ [1] https://search.maven.org/artifact/xerces/xercesImpl --=_d5f61de0b2eed55bda4713863e081027 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset= =3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen= eva,sans-serif'> <p>Hello, </p> <p>First post here, since I am not able to comment in this project's Jira. = I have run into an issue with Xerces2 during a Java 17 migration. JEP-403 m= entions the following under "Risks and assumptions": </p> <p>"Code that uses the JDK’s internal copy of the Xerces XML processo= r [might fail]. Such code should instead use a standalone copy of the Xerce= s library,<span> </span><a style=3D"color: #437291;" href=3D"https://s= earch.maven.org/artifact/xerces/xercesImpl">available from Maven Central</a= >."</p> <p><a href=3D"https://openjdk.org/jeps/403">https://openjdk.org/jeps/403</a= ></p> <p>The problem is that when including Xerces2 2.12.2 as a Maven dependency,= two properties are not recognized, which are relevant for security (to pre= vent XXE attacks:</p> <p>http://javax.xml.XMLConstants/property/accessExternalSchema</p> <p>http://javax.xml.XMLConstants/property/accessExternalDTD</p> <p><br /></p> <p>There is an open Jira topic to support these properties: <a href=3D"http= s://issues.apache.org/jira/browse/XERCESJ-1654">https://issues.apache.org/j= ira/browse/XERCESJ-1654</a></p> <p>This was created in 2015 and I am wondering what the current status is a= nd what a suitable workaround might be to fulfill that requirement of JEP-4= 03. </p> <p>Thanks a lot! </p> <p>Cheers,</p> <p>Martin </p> </body></html> --=_d5f61de0b2eed55bda4713863e081027--